Holden's Blog

Once again, Yahoo! has made a slight mis-step with protecting their users' information. In my attempt to enable interoperability between pcfspam & Yahoo! Mail, I uncovered another problem with the most recent Yahoo! Zimbra Desktop. The new Zimbra Desktop (build 1344) uses the same login methodology as the web login, which is already known to be replayable. Unfortunately, unlike the web login, it doesn't notify the user in the event of an SSL certificate mismatch. This makes Yahoo! Zimbra vulnerable to a man-in-the-middle attack, exposing both usernames and passwords. To reproduce this bug, simply download Zimbra desktop & set your host file (/etc/hosts) for login.yahoo.com to point to your local machine (127.0.0.1) by adding: 127.0.0.1 login.yahoo.com Alternatively, you can configure bind and add the Yahoo! zone: ; ; BIND data file for the fake yahoo zone ; $TTL 604800 yahoo.com. IN SOA localhost. root.localhost. ( ;@ IN SOA localhost. root.localhost. ( 2 ; ...

Capture of Yahoo! Desktop transmitting auth information Originally uploaded by dmcopernicus I've never really intended for this blog to be about security, but sometimes it just lands in your lap. Taking a break from my regular coding and school work, I went to the Yahoo "hacku" day in Waterloo . I wrote a basic system to help me deal with the problem of false negatives in e-mail spam which I'm planning on improving on. Since, like the majority of students I know, I use Gmail I initially made my program work with gmail. However, since the food was being purchased by Yahoo, I figured I should try and make my system work with Yahoo as well. At first glance, it didn't seem possible. Yahoo! doesn't presently offer IMAP support, and all the cool parts of there mail API require a pro account (which I later got, but didn't have at the time). Doing some digging, suggested that Yahoo did syncing for the new Yahoo Zimbra desktop product over IMAP , which wasn't ...